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Abstract 

We propose a new quantum key distribution (QKD) protocol based on the fully quantum me- 
chanical states of the Faraday rotators. The protocol is unconditionally secure against collective 
attacks for multi-photon source up to two photons on a noisy environment. It is also robust 
against impersonation attacks. The protocol may be implemented experimentally with the current 
spintronics technology on semiconductors. 
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I. INTRODUCTION 



The computational algorithm powered by quantum mechanics, on the one hand, has 
posed a serious threat to the classical cryptosystem l| . On the other hand, quantum cryp- 
tography allows for secure sharing of private keys. Ever since the pioneering works by Ben- 



net, Brassard, and Ekerti 



a great number of new quantum key distribution (QKD) 



protocols have been proposed to enhance the security and efficiency under non-idealistic 
situations and to incorporate new ideas [5]. In particular, Bostrom and Felbingerp] recently 
proposed the so-called ping-pong protocol. The protocol is interesting in that it enables direct 
communication deterministically and without classical communications (except for checking 

3e insecure in the case of lossy 



8], the idea still survives in a 



eavesdropping). Although the original protocol turned out to 
channels 7| and against blind attacks without eavesdropping 
recent modified version Q]. 

In the ping-pong protocol^, [^j, Bob sends a qubit to Alice, Alice performs a unitary 



operation on it with a random probability p and send it back to Bob, and finally Bob make a 
measurement on it. The unitary operation by Alice (if ever performed) transforms the initial 
state of the qubit to a state orthogonal to the initial state. This enables Bob to read Alice's 
massage directly. Putting another way, the unitary operation is performed conditioned on 
the classical information (0 or 1) that Alice wants to send to Bob. A conceptually interesting 
question would be, "What if we perform the unitary operation conditioned on the quantum 
state of another qubit?" In this work, we propose a new QKD protocol implementing this 
idea and address the security issues of it. The protocol is explained in Section [Til We 
will show in Sections II III and IIVI that the protocol is secure against eavesdropping for ideal 
single-photon source and robust against impersonation attacks. The protocol turns out to 
be insecure when the photon source produces more than two photons; this will be analyzed 
in Section [V] We will discuss in Section |VT] possible experimental realizations of the protocol 
using semiconductor spintronics. 

II. PROTOCOL 

While the protocol is independent of the physical system in use, we will have in mind the 
photon polarizations as travel qubits and electron spins as home qubits. In the description 
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FIG. 1: (color on-line) (a) Poincare sphere for photon polarization or Bloch sphere for spin, (b) 
Quantum Faraday rotation (QFR) or conditional rotation Ua-,c on C conditioned by A; see Eq. ([2]). 
It rotates the state of qubit C around z-axis by angle ±7r/2 depending on the state of qubit A. 
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FIG. 2: (color on-line) Quantum key distribution protocol using quantum Faraday rotators. 

of the protocol, we will use as the basis the eigenstates of o~ z , ||) (right-handed circular 
polarization) and | j) (left-handed circular polarization). We denote by \<j>) the state along 
the azimuthal angle on the equator of the Poincare (or Bloch) sphere: 

lt) + e + ^||) 



V2 



(1) 



The key element of our protocol will be the quantum Faraday rotation (QFR), namely, the 
Faraday rotation by angle tt/2 around z-axis of the Poincare sphere 

U A , C = exp H(7r/4)<7>£] (2) 

on the travel qubit C conditioned by the home qubit A. For example, operating on the 
product state \(f> = 0) A \4>) c , it gives 

v _e-^ 4 |T) A |0 + ) c + e+-/ 4 |I) A |0_) c 



(3) 



1AWIC- ^ 

where \<f>±) = \<f> ± 7r/2). In the quantum information theoretic terms, the QFR in Eq. (J2J) 
corresponds to the conditional phase shift. Possible physical realizations of QFR will be 
discussed later. 
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The protocol is as following. (1) To start the nth iteration of the proto col, Alice and 
Bob first prepare their home qubits A and B, respectively, in the state \<f> = 0)[10j]. (2) Alice 
then takes a travel qubit C and prepares it in the state \a). The angle a should be chosen 
randomly in the interval < a < 2n. (3) Alice performs (by interacting A and C) the 
QFR Ua-,c on C and send it to Bob. We note that on its way to Bob, the travel qubit C is 
maximally entangled with A: 

e-^\]) A W + ) c + e^/'\i) A \a.) c (4) 

(not normalized). (4) Bob receives C, performs Ub-c on it, and send it back to Alice. The 
qubit C is again maximally entangled on its way back to Alice, now with both A and B : 

(IU> + UT»Afll«>D-»*(ITT)-|U»Afll«>o (5) 

(not normalized), where \a) = \a + n). (5) Now Bob takes his own travel qubit D and 
prepares it in the state \(3). The angle f3 should be chosen randomly in the interval < 
(3 < 2tt. (6) Bob performs the QFR Ub-d on D and send it to Alice. (7) Alice receives D, 
performs Ua-d on it, and send it back to Bob. The final state of all the qubits A, B, C, and 
D is given by a GHZ-like state 

(IU) + lit)) ab Mod ~ (ITT) + \U))ab \*P)od ( 6 ) 

(8) Alice measures the observable S a = cos aa x + sinacr^ on C. Likewise, Bob measures 
the observable Sp = cos (3a x + smf3a y on D. They will get (in the ideal case) the identical 
result +1 or —1, which enables Alice and Bob to share the the key i^2n-i = 1 or 0. (9) If 
^2n-i = 1) Bob performs a x (the NOT gate), on his home qubit B. (10) Alice and Bob 
measures a z on their home qubits A and B, respectively. Depending on the measurement 
result, another bit of key K 2n = (a x = +1) or 1 (a x = —1) is generated. (11) Repeat 
the steps 1 through 10 with n increased by 1 until n becomes N. (12) Alice and Bob takes 
randomly M bits out of {K 2 k-i\k = 1, • • • ,N}, and test possible eavesdropping (or any 
other attack) by comparing the values through a classical communication channel. 

A few remarks on the procedure are in order. Alice can measure S a (see Step 8 above) 
even before the Step 5. It follows from the GHZ-like structure of the states in Eqs. ([5]) and 
(EJ). Step 9 is not essential. It can be removed with a minor change in Step 10. 

Before analyzing the security of the protocol, we point out a few interesting features of 
the protocol. First, the travel qubit is always in a maximally entangled states with the home 
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FIG. 3: (color on-line) General attack on a noisy environment. 



qubit(s) whenever exposed to eavesdropping. This is the essential feature of the protocol 



that provides the protocol with the security. Second, at the key sharing stage no c 



assical 



This 



communication is necessary. The key is shared only through the quantum channel 
is also closely related to the security of the protocol. Third, two bits are generated out of 
one iteration and they have the common security fate. If the first bit has been tampered 
by eavesdropping or noise in the channel, the security of the second bit is not guaranteed 
either. 



III. SECURITY PROOF 

Let us analyze general attacks from a third party in case the photon source generates 
single photon. We closely follow the lines in Ref.|9|. As usual, Eve is assumed to be an 
almighty eavesdropper limited only by the law of physics. The most general (assuming that 
Eve does not know Alice's choice of basis) operation S\ Eve can do on the travel qubit C 
can be written as 

£ \l)c \ e )E = e \l)c \ € oo)e + f It)c M e > ( 7 ) 

and 

£1 \l)c \ € )e = e \l)c l e n)i? + / \l)c l e io> ^ , (8) 

where the states |eoo), |eoi), l e n) ; an d |eio) of the ancilla E are normalized, but not orthogonal 
to each other. Without loss of generality, we can set (e o|eoi) = (eool e io) — ( e iol e n) — 
( e oi| e n) — 0, from the unitarity of ^ijs]. 

The basis {I7) , I7)} for C is an arbitrary choice made by Eve. Recall that the angle a has 
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been chosen randomly for each travel qubit C and is never announced to the public; this is 
one of the biggest differences of our protocol both from the BB84-type and ping-pong-type 
protocols. 

When (e o|en) = (eoi| e io) — 1> Eve cannot distinguish between \j) c and \j) c by any 
measurement on her ancillae. In this case, Eve can acquire no more information than no 
attack is performed. Therefore, a minimal requirement for Eve's strategy is that such an 
operation as gives no information at all to her should not be detected by the legitimate 
partners (Alice and Bob). This can be achieved if Eve does not disturb travel qubits. It 
gives the condition, |e| = 1 and |/| = 0. In passing, we note that (eoo|en) = corresponds 
to an intercept-and-resend attack. 

Having this (|e| = 1 and |/| = 0) in mind, we rewrite the attack operation on the travel 
qubit as 



£ 1 \ a+ ) c = \a+) c [ cos - |e 00 ) + sin - \e Ul 



a a 

+ « sin -cos- |a_) c (|e o) - |en)) (9) 



and 



£i \a-) c = -« sin - cos - \a + ) c (|e 00 ) - |en)) 



/ 2 a 2 a \ \\ 

+ |a_) c lsm -|e 00 ) + cos — |en) I , (10) 



where a = a — 7 + ir/2. 

On C's way from Bob back to Alice, Eve can perform another similar attack £ 2 with a 
new ancilla F. With the same requirement as in Si, the attack operation £ 2 takes the simple 
form 

£2\i) c \-n) F = It)cI 7 7oo)f ( n ) 

and 

^l7>cl»?>F = l7>ol»hi>F- ( 12 ) 
Since our protocol is symmetric between Alice and Bob, Eve's attack operations £[ and £' 2 
on Bob's travel qubit D can be written, analogously to E\ and £2, with respect to new ancillae 
E' and F' . The optimal Eve's attack will be the symmetric one such that (e o|en) = (eool e n) 
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and (?7oo|?7ii) = (^ool^ii)- The angle (3 = (3 — 7 + n/2 relates Bob's choice {\(3) , and 
Eve's choice {(7) , |7)} for the basis for D. 

After all the procedures by Alice and Bob, Eve performs a collective measurement on her 
ancillae E, F, E', and F' . From the measurement result, she extracts the information about 
the state of Alice's home qubit A and Bob's B; namely, the information about the results 
of the QFR on the travel qubits C and D. The information is eventually the information 
about the key values shared by Alice and Bob. 

The operations Si, S 2 , £[, and S' 2 by Eve inevitably disturb the quantum state of the travel 
qubit C and D. Simply comparing the test key bits (step 12 of the protocol), Alice and Bob 
may detect the attack. The detection probability pd depends on the angle differences a and 
(3. Since the angles a and (3 are randomly distributed, the detection probability is given by 

Pd — ^ — - (cos 2 x + cos 2 y + cos 2 x cos 2 y) , (13) 
8 8 

where cosx = (e o|en) = ( e ool e 'n) an d cosy = (^ool^n) — (v'ooWn)- The maximum value of 
Pd is 3/8 corresponding to the intercept-and-resend attack(cosx = cosy = 0). 
Let us suppose that the initial state prepared by Alice and Bob is given by 

l*>i = |O>jO> fl h0) OI ,. (14) 

After all attacks the final state is given by 
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\ a @)cD { 7 sin " sin /5|TT)Ai? \ 1 )ef\ V )e>f> + \U)ab\ 5 )ef\ 2 ')e>f> 



2 1 ' luu 4 



with 



and 



+ IIT) A b |2) £F |5%, f , + - sin5sin/3 \A) EF \A') E , F , 



4 

f 2~ \ a P)cD \ - ^ sin « ITT)ab l 1 )^ l 3 'W - ^ sin ^ ITDab l 5 >£F |!'W 



+ ^sin/3|lT) Ai? |2) £F |4%, F , + % - S ma\ii) AB \A) EF \&) E , F , 



2 I«^)cd I - 2 sill/ ^ H"T)ab l 3 )i?F |1'W + 2 sin " \U)ab \ A )ef \ 2 ')e>f> 

1 1 ~ 

- 2 sin « UT)ab l 1 )^ l 5 'W + g Sil1 ^ Ui)AB l 6 )i5F l 4 'W 

+ 5 Woo I ~ \^)ab \ 3 )ef l 3 'W + \ sinasin/3 |TI) AB (4)^ 

+ ^sinasin/3|ITU|l) i;F |4') i; ,F'-|lI)AB|6)^|6 / W } (15) 



l 1 )^ = koo)^ \voo) F ~ \en) E \vn) F ( 16 ) 

|2) BF = sin 2 | |e 00 ) £ IWf + cos2 f l e n>,E I*7h)f ( 17 ) 

|3)bf = cos2 g l e ° ^ IWf + sin 2 - |e u ) E |^n) F (18) 

I 4 )ef = IWf - l e n)i? \Voo) F (19) 

\5) EF = cos 2 - leoo)^ hn) F + sin 2 | |en) E |r/ o) F (20) 



|6) £F = sin 2 - |e 00 ) £ \vn) F + cos2 g ' ei1 ^ l^ 00 ^ ( 21 ) 



The states \2') E , F ,, \3') E , F ,, \A') E , F ,, 15')^,, and \&) E , F , are defined analogously 

(with a replaced by (3). 

Equation (TI5]) clearly reveals how Eve can extract the information about the quantum 
state of the Alice's and Bob's home qubits A and B, respectively. For example, Eve can infer 
the state on Bob's home qubit B if she finds her ancilla qubits E and F in the collective 
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state |1) FF , |2) FF , or |3) FF . Likewise, Eve infers the state ||) B if she finds E and F in the 
state |4) FF , |5) FF , or |6) FF . The state of Alice's home qubit A can be inferred analogously 
from the ancillae E' and F' . The remaining question for Eve would be, for example, how to 
distinguish the states |1) FF , |2) FF , and |3) FF from |4) FF , |5) FF , and |6) FF . 
To this end, we first note that 



(1|4) FF =(1|5) FF =(1|6) FF = (22) 

and that 

(4|1) FF =(4|2) FF =(4|3) FF = 0. (23) 

Therefore, Eve's best policy will be first to exploit the orthogonal subspaces containing |1) FF 
and |4) FF , respectively, and then to distinguish the non-orthogonal states, namely |2) FF and 
|3) FF from |5) FF and |6) FF , within these subspaces. Further, defining the normalized overlap 

mi 



(i\j) EF = - '" ,J,EF = (24) 

V W> EF (JW EF 



(i, j — 1, • • • , 6), we have the inequalities 



(2|5) FF = (3|6) FF > min{cosx,cosy} (25) 



and 



(2|6) FF = (3|5) FF > min{cosx,cosy} (26) 

Namely, the states |2) FF and |3) FF can be distinguished worse from |5) FF and |6) FF than 
any two states with the mutual overlap of min{cosx, cosy} can be distinguished from each 



other. Based on this observation, we analyze the worst case, where (2|5) FF = (3|6) 



EF 



(2|6) FF = (3|5) FF = min{cosa:, cosy}. Further, it is clear that the optimal attack for Eve is 
the balanced one {{J, for which cosx = cosy, and hereafter we focus on the balanced case. 

Putting all the above observations together and with lengthy algebra, one can calculate 
the mutual information I(A, B) between Alice and Bob and I(A, E) [or I(B, E)\ between 
Alice (or Bob) and Eve; note that because of the symmetry in our protocol, I(A, E) = 
I(B,E). They are given by 

I(A,B) = l+p d \og 2 p d + {l- Pd )\og 2 {l-p d ) (27) 

and 

I(A,E) = l+p e log 2 p e + (l-p e )log 2 (l-p e ), (28) 
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FIG. 4: (a) Mutual information a function of the detection probability, pd, for general incoherent 
attacks against our protocol. The solid (dashed) line represents the mutual information I (A, B) 
[I (A, E)\ between Alice and Bob (Alice and Eve), (b) I(A,B) +I(A,E) as a function of pd for 
our protocol (solid line) and for the BB84 protocol (dashed line). For our protocol, the maximum 
value of pd is 3/8. 

respectively, pd in Eq. f[2"T|) is the detection probability [see Eq. ([TBI) ] for the balanced attack 
(cos x = cosy), and p e in Eq. ( 1281) is defined by 



Pe 



1 

2 



I 



'1 - 2p d (l - VI - 2j?d 



2y/l-2p d +J2(l 



2 Pd 



(29) 



For a QKD to be secure, it is required that I(A,B) > I (A, E)\^. The mutual information 
I (A, B) and I(A, E) are plotted as functions of the detection probability pd in Fig. [H The 
maximum information between Alice and Eve occurs at pd = 0.345, which is less than the 
maximum detection probability (pd = 3/8) corresponding to the intercept-and-resend attack. 
This means that the intercept-and-resend attack is not an optimal attack for Eve. I(A, B) 
and I(A, E) becomes equal for the detection probability pd = 0.266188. This detection 
probability is greater than pd = 0.18 for the ping-pong protocol |9j and pd = 0.15 for BB84 
protocol. 

So far the security has been analyzed for incoherent attacks. In general, Eve can attacks 
many qubits coherently by collecting many ancillae and performing a global measurement on 
them. Since our protocol shares many common features with the BB84 or similar protocols, 
we can first follow the lines in Section VI. G of Ref. 5| to prove the security of our protocol 



against co 
attacks 



lective attacks [l^. An argument for the security against the most general coherent 



131 ] is given below. After Alice and Bob repeats the protocol n times to share a key 



of length of 2n bits, the sum of the mutual information I(A, B) and I(A, E) should be less 
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than 2n, i.e., 

I(A, B) + I(A, E) < 2n . (30) 

Equivalently speaking, I(A, B) + I(A, E) < 1 per single qubit. This is because Eve 
and Bob cannot acquire more information than is sent out mutually by Alice and 
Bob whatever measurement is performed by Eve. Therefore, in order that I(A, B) > 
I(A,E) (Theorem 1 in Ref. |5|), it suffices to have I{A,B) > n. Since I(A,B) = 
2n [1 + Pd\og 2 Pd + (1 — Pd) log 2 (l — Pd)} , Pd is required to be less than 0.110028, approx- 
imately 11 %, which is the upper bound for the BB84 protocol [3, Q|- This proves that our 
protocol is at least as secure as the BB84 protocol against collective attacks. The above lines 
of proof applies only for collective attacks. However, it has been argued that the collective 
attack may be the optimal one of the most general coherent attacks 14j]. It is also interesting 
to note that for incoherent attacks, I (A, E) in Eq. (128]) is significantly restricted and hence 
the sum I (A, B) + I (A, E) per single qubit is far less than 1; cf. fl30|) . This is demonstrated 
in Fig. |4] (b) comparing the sum for the BB84 protocol and for ours. It suggest that the 
upper bound pd ~ 11 % may be reduced further with proper analysis of the restriction on 
the possible measurements by Eve. More detailed analysis of the security of our protocol 
against the coherent attacks should therefore be an interesting topic for further studies in 
the future. 



IV. IMPERSONATION ATTACK 

In our protocol, Alice sends a qubit to Bob and gets it back. So does Bob with another 
travel qubit. It is possible for Eve to intercept the channel and pretend to be her/his 
legitimate partner to each. One can think of two different ways of impersonation attack. In 
the first method [see Fig.[5](a)], Eve uses two home qubits of her own. Eve can use one of the 
two to share a perfect key with Alice following the procedures of the protocol in Section [Til 
and the other to share another key with Bob. However, the keys so generated to Alice and 
Bob are independent and have no correlation. Therefore, by bit verification procedure, this 
attack can be detected with probability 1/2. 

In the second method [see Fig. EJ^b)], Eve uses only one home qubit E of her own, which 
is used for the interaction with both Alice and Bob. In this case, the total wave function of 
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FIG. 5: Impersonation attack 
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FIG. 6: Photon-number splitting attack, 
the whole qubits is given by 

(ITTT) + HID) \m) + (IUT) + im» l«/3e) 

+ (ITTI) + HIT)) l«/3e> + (ITU) + |m» |^e) (31) 

(not normalized), where the product states are arranged such as l---)^^ \ ---)cde> i^' ls t ne 
travel qubit of Eve's). It then follows immediately that the detection probability of this 
attack is still 1/2. 

V. PHOTON NUMBER SPLITTING ATTACK 

Finally, we investigate the security of the protocol against the photon number splitting 
attack (PNS). (We note that the security analysis in the case of lossy channel is essentially 
the same as that against the PNS attack.) Let us suppose that the photon source generate 
three photons (the discussion can be trivially generalized to the case of more photons; see 
below). Eve takes one photon (say E{) on the quantum channel from Alice to Bob and 
another (E 2 ) on the channel back to Alice from Bob; see Fig. [6j Only photon C finally 
arrives at Alice's hand. Similarly, Eve takes photons E[ and E' 2 out of the photons from 
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FIG. 7: (color on-line) A variation of the protocol using four home qubits. 

Bob. Bob receives back only D. The final state of the whole photons and home qubits are 
given by 

1 ITT) \af3) |a/3) I a/3) - i |U) \a(3) |a/3) |a/3) 

+ HI) |a/3) |a/3) |a/3) + ||t> |a/3) |a/3) |a/3) , (32) 

where the product states have been denoted according to the arrangement of the qubits such 
as 1-.)^ \--)e 1 e 2 \--)e[e' \--)cd- -^ ve w& its until Alice and Bob performs projective measure- 
ment on their travel qubits C and D. Then the wave function in Eq. (|32l) collapses into 
either 

|TT) I a/3) I a/9) - |||) I a/3) |a^) |a^) (33) 

or 

|U) |a/3) |a/3) |a/3) + ||T) |a/9) |a/3) |a/3) . (34) 

Therefore, Eve can know the key without being detected simply by checking whether 
( e i| e 2) ( e 'il e 2) > (Alice and Bob share the key 0) (ei|e2) (e'll^) < (Alice and Bob share the 
key 1), where ei, e[ — a, a and e 2 , e' 2 = f3, /3. This test can be easily done, for example, using 
an interferometer. The discuss is trivially generalized to the case of even more photons. It 
is enough for Eve to steal two photons from Alice and another two from Bob. 

One may be tempted to overcome this problem using four home qubits (two for Alice and 
two for Bob) as illustrated in Fig. [71 This scheme "hides" by means of entanglement the 
output state of C and D even after Alice and Bob performs projective measurements on C 
and D. However, following the similar lines as above, the total wave function of the whole 
qubits is given by 
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- - \a(3) (|$+^+) |$+^+) + |$+*-) - |$-^+) |$-*+) - |$-^-) |$-*-» 

- - \ap) (|^~$~) |# + $+) - |^"$+) |* + $-) + |*+$") |*-$ + ) - |#+$+) |^"$ - )) 

- % - \a(3) |$+$+) - |*-*-) |$ + $-) - |^+^+) |$-$+) + |$"$")) 

+ 1 1 a/3) (|$ + $-) |^+^+) + |$+$+) |$+$-) + |$-$-) + |$-$+) (35) 

arranging the product states such as \--) CD \--) a 1 a 2 b 1 b 2 \--) e 1 e 2 e' 1 e , 2 Therefore, in order to 
know the key, all Eve has to do is to distinguish the Bell state |$ ) from l^/ 1 * 1 ), which is as 
easy as the test for the two-home-qubit scheme analyzed above. 



VI. EXPERIMENTAL FEASIBILITY 

The parametric Faraday rotation of photon polarization by atomic spins have been widely 
used in quantum optics and atomic physics. For example, it has been used for quantum 
non-demolition measurement of the atomic spin[l5, 16, 17 1. However, because of the weak 



atom-photon interaction, the Faraday rotation angle is usually quite small (several degrees). 
To enhance the atom-photon interaction to achieve the rotation angle of tt/2, one has to 
put an atom to a cavity. However, trapping a single atom in a cavity is still technologically 
challenging. 

Another candidate for a conditional Faraday rotation of photon polarization is the quan- 



tum dot in a micro-cavity, which has already been demonstrated experiment ally 1 1 8l. [19]. 
Here the photon interacts with the electron spin in the semiconductor quantum dot. The 
transmission distance is limited mainly by the coherence time of the electron spin in the 
quantum dot. The maximum transmission distance (given by the speed of light) would 



20l | and for 10 ms [21] in one-way 



be 10 m and 1 x 10 6 m for coherence times of 100 ns 
transmission. We believe the distance limitation will be extensively relaxed in the near 
future. 

VII. CONCLUSION 

We have proposed a new QKD protocol exploring the quantum states of the Faraday 
rotators. The protocol is secure against eavesdropping for ideal single-photon source and 
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robust against impersonation attacks. This protocol is not allowed for multiphoton source 
which produces more than two photons. The protocol could be implemented experimentally 
with semiconductor quantum dots in micro-cavity. 
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